Mattias,

I recently took a class on securing Cold Fusion in a MS-IIS environment and
mentioned the issue of the installation program that most s/w packages use
(particularly MS patches...)that is installed along w/ IE. I was told the
install program is available as a separate package, though I'm afraid I
cannot tell you what the specific program or download to get.

Other than that, if you need a browser (so many help files use HTM for help
docs now), try a lesser known scaled down browser that's likely to be less
exploited. After all it seems to me that haclers and crackers think it more
'fun' to try to cripple big-bad MS rather than some shareware item.
Marty

-----Original Message-----
From: Grab Raham [mailto:grabrahamhotmail.com]
Sent: Friday, December 14, 2001 6:47 PM
To: focus-mssecurityfocus.com
Subject: RE: Blind penetration testing

If it is NEVER used then it other applications would not REQUIRE it correct?
It may not be used be a human to retrieve files from the internet but other
applications installed on the server may use it to retrive files from the
internet.

-----Original Message-----
From: Mattias Nyholm [mailto:mattias.nyholmframfab.se]
Sent: Friday, December 14, 2001 3:29 AM
To: focus-mssecurityfocus.com
Subject: MS01-058/IE patch - why is it rated critical on servers?

Hi all,

I just read MS01-058 which discusses the new patch for IE6
and IE5.5SP2. It's nice to have a cumulative patch for client systems, but
why is it rated as critical for servers as well?

We have IE installed on servers since it is required by other applications,
but is it really necessary to patch IE even on a server where it's never
used?

MS01-058 is available here:
http://www.microsoft.com/technet/security/bulletin/MS01-058.asp

Regards,

Mattias

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp.

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]